Resource allocation without limits in Autodesk AutoCAD product suite, Revit, Design…
Priority LOW 35CWE-770Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.
Summary
Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated buffer while parsing PDF files. This vulnerability may be exploited to execute arbitrary code.
Why it matters now
EPSS 0.0079 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Autodesk AutoCAD product suite, Revit, Design Review and Navisworks | 2022, 2021, 2020,2019 | — | No fix listed | CNA |
- Autodesk AutoCAD product suite, Revit, Design Review and Navisworks Vendor— Affected 2022, 2021, 2020,2019 Fixed in — No fix listed CNA
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:3ds_max:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:3ds_max:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:advance_steel:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:3ds_max:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:3ds_max:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:advance_steel:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:macos:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_architecture:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_civil_3d:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_civil_3d:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_civil_3d:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_civil_3d:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_electrical:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_electrical:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_electrical:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_electrical:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_lt:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_lt:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_lt:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_lt:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_lt:2022:*:*:*:*:macos:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_map_3d:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mechanical:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_mep:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:autocad_plant_3d:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:* | 2018 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:navisworks:2019:*:*:*:*:*:*:* | 2019 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:navisworks:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:navisworks:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:revit:2020:*:*:*:*:*:*:* | 2020 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:revit:2021:*:*:*:*:*:*:* | 2021 | Vulnerable | Autodesk |
| cpe:2.3:a:autodesk:revit:2022:*:*:*:*:*:*:* | 2022 | Vulnerable | Autodesk |
- cpe:2.3:a:autodesk:autocad:2022:*:*:*:*:macos:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_architecture:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_civil_3d:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_civil_3d:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_civil_3d:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_civil_3d:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_electrical:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_electrical:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_electrical:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_electrical:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_lt:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_lt:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_lt:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_lt:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_lt:2022:*:*:*:*:macos:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_map_3d:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mechanical:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_mep:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:autocad_plant_3d:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:design_review:2018:-:*:*:*:*:*:* Versions 2018 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:navisworks:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:navisworks:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:navisworks:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:revit:2020:*:*:*:*:*:*:* Versions 2020 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:revit:2021:*:*:*:*:*:*:* Versions 2021 Vulnerable ·Autodesk
- cpe:2.3:a:autodesk:revit:2022:*:*:*:*:*:*:* Versions 2022 Vulnerable ·Autodesk
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-27871
- 2026-10-03 Alias added: GHSA-5gx4-f3wm-4qq2
References
More Autodesk 3ds Max vulnerabilities
- TI-2009-03414 Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers… CVSS 2.0HIGH 9.3
- TI-2026-00455 Out-of-Bounds Write in RGB File Parsing CVSS 3.1HIGH 8.4
- TI-2026-00454 Stack Based Buffer Overflow in GIF File Parsing CVSS 3.1HIGH 8.4
- TI-2026-00341 GIF File Parsing Out-of-Bounds Write CVSS 3.1HIGH 8.4
- TI-2026-00340 RGB File Parsing Memory Corruption CVSS 3.1HIGH 8.4
- TI-2025-06023 TGA File Parsing Memory Corruption Vulnerability CVSS 3.1HIGH 7.8
Sources
- CVE-2022-27871 · CVE Program
- CVE-2022-27871 · NVD
- FIRST EPSS
- GHSA-5gx4-f3wm-4qq2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences